What is the CVSS score of CVE-2026-9884?

CVE-2026-9884 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9884?

Google Chrome on macOS systems is vulnerable to remote code execution through a memory safety flaw affecting versions prior to 148.0.7778.216, potentially compromising employee systems and sensitive…. A patch is available.

How to fix or mitigate CVE-2026-9884?

Within 24 hours: Inventory all macOS systems running Chrome and identify those below version 148.0.7778.216; declare this a critical priority patch requiring immediate deployment. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all affected endpoints using automated patch management. Within 30 days: Audit patch compliance, document deployment completion, and monitor for exploitation attempts.

Google Chrome CVE-2026-9884

EUVD-2026-33179 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-2mpm-mp7x-8jhg

Use After Free RCE Memory Corruption Google Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:26 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Browser in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to version 148.0.7778.216 allows attackers to exploit a use-after-free flaw in the Browser component via a malicious HTML page. Rated Critical by Chromium's security team with a CVSS of 8.8, exploitation requires user interaction (visiting a crafted page) but no authentication, and no public exploit identified at time of analysis. A vendor patch is available through the Chrome stable channel update.

Technical ContextAI

The vulnerability is a use-after-free condition (CWE-416) in the Browser process of Google Chrome, the privileged component that brokers access to OS resources, profile data, and child renderer processes. Use-after-free flaws occur when memory is referenced after it has been freed, allowing an attacker to manipulate the freed memory region - often via heap grooming and crafted JavaScript/HTML - to redirect control flow or corrupt object state. Because the bug resides in the Browser process (not a sandboxed renderer), successful exploitation can yield code execution outside the renderer sandbox on macOS, as identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade Google Chrome on macOS to 148.0.7778.216 or later via the Chrome stable channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html - most installations will receive this automatically on next browser restart, so enterprise teams should force-restart Chrome processes and validate version rollout through MDM or Google Admin console. No vendor-supplied workaround is published; as compensating controls until patching completes, consider restricting browsing to known-good sites via web proxy allowlisting (trade-off: breaks general web access), disabling JavaScript on untrusted origins through enterprise policy DefaultJavaScriptSetting (trade-off: breaks most modern web apps), or temporarily routing users to an alternative browser on macOS endpoints (trade-off: workflow disruption and loss of Chrome-specific extensions/sync). Downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) likely require their own corresponding updates - verify each vendor's advisory.